manifests/site.pp

   1 Package {
   2     require => File["/etc/apt/apt.conf.d/local-recommends"]
   3 }
   4
   5 File {
   6     owner   => root,
   7     group   => root,
   8     mode    => 444,
   9     ensure  => file,
  10 }
  11
  12 Exec {
  13     path => "/usr/bin:/usr/sbin:/bin:/sbin"
  14 }
  15
  16 node default {
  17     $localinfo = yamlinfo('*', "/etc/puppet/modules/debian-org/misc/local.yaml")
  18     $nodeinfo  = nodeinfo($fqdn, "/etc/puppet/modules/debian-org/misc/local.yaml")
  19     $hoster    = whohosts($nodeinfo, "/etc/puppet/modules/debian-org/misc/hoster.yaml")
  20     $keyinfo   = allnodeinfo("sshRSAHostKey", "ipHostNumber")
  21     notice("hoster for ${fqdn} is ${hoster}")
  22
  23     $mxinfo   = allnodeinfo("mXRecord")
  24
  25     include munin-node
  26     include sudo
  27     include ssh
  28     include debian-org
  29     include monit
  30     include apt-keys
  31     include ntp
  32
  33     include motd
  34
  35     case $hostname {
  36         finzi,fano,fasch,field:    { include kfreebsd }
  37     }
  38
  39     case $smartarraycontroller {
  40         "true":    { include debian-proliant }
  41     }
  42     case $kvmdomain {
  43         "true":    { package { acpid: ensure => installed } }
  44     }
  45     case $mptraid {
  46         "true":    { include "raidmpt" }
  47     }
  48
  49     case $mta {
  50         "exim4":   {
  51              case extractnodeinfo($nodeinfo, 'heavy_exim') {
  52                   'true':  { include exim::mx }
  53                   default: { include exim }
  54              }
  55         }
  56     }
  57
  58     case extractnodeinfo($nodeinfo, 'muninmaster') {
  59         true: { include munin-node::master }
  60     }
  61
  62     case extractnodeinfo($nodeinfo, 'nagiosmaster') {
  63         true:    { include nagios::server }
  64         default: { include nagios::client }
  65     }
  66
  67     case $apache2 {
  68          "true":  {
  69               case extractnodeinfo($nodeinfo, 'apache2_security_mirror') {
  70                      true:    { include apache2::security_mirror }
  71                      default: { include apache2 }
  72               }
  73          }
  74     }
  75
  76     case extractnodeinfo($nodeinfo, 'buildd') {
  77          'true':  {
  78              include buildd
  79              case $kernel {
  80                  Linux: {
  81                      include ferm
  82                  }
  83              }
  84          }
  85     }
  86
  87     case $hostname {
  88         klecker,ravel,senfl,orff: { include named::secondary }
  89         geo1,geo2,geo3:           { include named::geodns }
  90         bartok,schein,steffani:   { include named::recursor }
  91     }
  92
  93     case $hostname {
  94         franck,powell,logtest01,geo1,geo2,geo3,bartok,senfl,beethoven,piatti,saens,villa,lobos,raff,gluck,schein,wieck,steffani,ball,handel,tchaikovsky,heininen,nielsen,kokkonen: { include ferm }
  95     }
  96     case $hostname {
  97         zandonai,zelenka: {
  98            @ferm::rule { "dsa-zivit-rrdcollect":
  99                description  => "port 6666 for rrdcollect for zivit",
 100                rule         => "&SERVICE_RANGE(tcp, 6666, ( 10.130.18.71 ))"
 101            }
 102            @ferm::rule { "dsa-zivit-zabbix":
 103                description  => "port 10050 for zabbix for zivit",
 104                rule         => "&SERVICE_RANGE(tcp, 10050, ( 10.130.18.76 ))"
 105            }
 106         }
 107         piatti: {
 108            @ferm::rule { "dsa-udd-stunnel":
 109                description  => "port 8080 for udd stunnel",
 110                rule         => "&SERVICE_RANGE(tcp, http-alt, ( 192.25.206.16 70.103.162.29 217.196.43.134 ))"
 111            }
 112         }
 113         senfl: {
 114            @ferm::rule { "dsa-rsync":
 115                     domain          => "(ip ip6)",
 116                     description     => "Allow rsync access",
 117                     rule            => "&SERVICE(tcp, 873)"
 118            }
 119         }
 120         saens,villa,lobos,raff,gluck,schein,wieck,steffani: {
 121            @ferm::rule { "dsa-ftp":
 122                     domain          => "(ip ip6)",
 123                     description     => "Allow ftp access",
 124                     rule            => "&SERVICE(tcp, 21)"
 125            }
 126            @ferm::rule { "dsa-rsync":
 127                     domain          => "(ip ip6)",
 128                     description     => "Allow rsync access",
 129                     rule            => "&SERVICE(tcp, 873)"
 130            }
 131         }
 132         ancina,zelenka: {
 133            @ferm::rule { "dsa-time":
 134                     description     => "Allow time access",
 135                     rule            => "&SERVICE_RANGE(tcp, time, \$HOST_NAGIOS_V4)"
 136            }
 137         }
 138         handel: {
 139            @ferm::rule { "dsa-puppet":
 140                     description     => "Allow puppet access",
 141                     rule            => "&SERVICE_RANGE(tcp, 8140, \$HOST_DEBIAN_V4)"
 142            }
 143            @ferm::rule { "dsa-puppet-v6":
 144                     domain          => 'ip6',
 145                     description     => "Allow puppet access",
 146                     rule            => "&SERVICE_RANGE(tcp, 8140, \$HOST_DEBIAN_V6)"
 147            }
 148         }
 149         powell: {
 150            @ferm::rule { "dsa-powell-v6-tunnel":
 151                     description     => "Allow powell to use V6 tunnel broker",
 152                     rule            => "proto ipv6 saddr 212.227.117.6 jump ACCEPT"
 153            }
 154            @ferm::rule { "dsa-powell-btseed":
 155                     domain          => "(ip ip6)",
 156                     description     => "Allow powell to seed BT",
 157                     rule            => "proto tcp dport 8000:8100 jump ACCEPT"
 158            }
 159            @ferm::rule { "dsa-powell-rsync":
 160                     description     => "Hoster wants to sync from here, and why not",
 161                     rule            => "&SERVICE_RANGE(tcp, rsync, ( 195.20.242.90 192.25.206.33 82.195.75.106 206.12.19.118 ))"
 162            }
 163         }
 164         beethoven: {
 165            @ferm::rule { "dsa-merikanto-beethoven":
 166                     description     => "Allow merikanto",  # for nfs, and that uses all kind of ports by default.
 167                     rule            => "source 172.22.127.147 interface bond0 jump ACCEPT",
 168            }
 169         }
 170         heininen: {
 171            @ferm::rule { "dsa-syslog":
 172                     description     => "Allow syslog access",
 173                     rule            => "&SERVICE_RANGE(tcp, 5140, \$HOST_DEBIAN_V4)"
 174            }
 175            @ferm::rule { "dsa-syslog-v6":
 176                     domain          => 'ip6',
 177                     description     => "Allow syslog access",
 178                     rule            => "&SERVICE_RANGE(tcp, 5140, \$HOST_DEBIAN_V6)"
 179            }
 180         }
 181
 182     }
 183     case $brokenhosts {
 184         "true":    { include hosts }
 185     }
 186     case $hoster {
 187         "ubcece", "darmstadt", "ftcollins", "grnet":  { include resolv }
 188     }
 189     case $portforwarder_user_exists {
 190         "true":    { include portforwarder }
 191     }
 192     include samhain
 193 }